tips:suricata-eve-unixsocket
This is an old revision of the document!
Table of Contents
Suricata-EVE-Unixsocket
This article provides instructions for installing Suricata-Eve-Unixsocket app in Trisul Network Analytics. The Suricata-Eve app allows you to integrate Suricata IDS alerts into Trisul metrics framework.
Installation
1. Installing Suricata App
- You can install the app by logging in as admin and selecting Web Admin > Manage > Apps > Suricata via Eve Unixsocket.
2. Installing Suricata version 5.0
Please install Suricata by running the following command,
add-apt-repository ppa:oisf/suricata-stable sudo apt-get update apt-get install suricata
3. Updating with latest ruleset
Use the following command to update the latest emerging-threats ruleset
sudo suricata-update
suricata-update puts the combined rules in /var/lib/suricata/rules
which is owned by root. Make sure the trisul user can read this directory.
sudo chown trisul.trisul /var/lib/suricata -R
4. Enabling EVE_unix Socket
- locate the 'Outputs' section in /etc/suricata/suricata.yaml enable EVE logging as shown below.
# Extensible Event Format (nicknamed EVE) event log in JSON format - eve-log: enabled: yes filetype: unix_dgram #regular| filename: suricata_eve.socket
The Filename is 'suricata_eve.socket' is the name of the Unix Datagram socket file that Trisul will listen to later.
5. Starting Suricata
- Login as Admin and Select Admin Tasks.
- Click on 'More options' dropbox at the end of probe0.
- You will find a Dialog box with command line to install Suricata as below.
- Cut and paste the command shown into a terminal to start suricata
sudo suricata --user trisul -l /usr/local/var/lib/trisul-probe/domain0/probe0/context0/run -c /etc/suricata/suricata.yaml -i ens33 -D
6. Viewing Alerts
tips/suricata-eve-unixsocket.1599740217.txt.gz · Last modified: 2020/09/10 17:46 by navaneeth